Main » Forums home » Research and development

All times are UTC - 5 hours [ DST ]

Forum rules


Please do not post questions about data recovery cases here (use this forum instead). This forum is for topics on finding new ways to recover data. Accessing firmware, writing programs, reading bits off the platter, recovering data from dust...



Post new topic Reply to topic  Page 1 of 1
  [ 9 posts ] 
  Previous topic | Next topic 
Author Message
bunty
 Post subject: Adding Customs file Signatures in R-studio
PostPosted: October 21st, 2023, 0:16 
Offline

Joined: March 9th, 2017, 6:16
Posts: 103
Location: trinidad
I want to add custom file signature of a file in r-studio. I have tried many times as per process described in R-studio manual but I am unable to do the same and create xml file. Can someone pls. help. I can send test file in PM.
Thank You
Top
 Profile  
 
bunty
 Post subject: Re: Adding Customs file Signatures in R-studio
PostPosted: October 21st, 2023, 4:25 
Offline

Joined: March 9th, 2017, 6:16
Posts: 103
Location: trinidad
Finally I have created 2 signatures .I have taken 2 hex strings since I don't know which one is right (how many hex characters to take)
can someone pls check & correct me

xml download link -- https://drive.google.com/file/d/1kFNsAa ... share_link


Attachments:
4444.PNG
4444.PNG [ 17.56 KiB | Viewed 4093 times ]
3333.PNG
3333.PNG [ 3.89 KiB | Viewed 4093 times ]
22222.PNG
22222.PNG [ 45.76 KiB | Viewed 4093 times ]
1111.PNG
1111.PNG [ 40.9 KiB | Viewed 4094 times ]
Top
 Profile  
 
Arch Stanton
 Post subject: Re: Adding Customs file Signatures in R-studio
PostPosted: October 21st, 2023, 9:27 
Offline
User avatar

Joined: May 13th, 2019, 7:50
Posts: 913
Location: Nederland
I'd go with TAPE \x54\x41\x50\x45

If you don't have the spec you don't know how static rest of the 'header' is and so the larger the signature the more chance you will not pick up files with slightly different 'headers'.

OTOH if you know for a fact that for example first 20 bytes of a header are static, you go with that as it will reduce false positives.

_________________
Joep - http://www.disktuna.com - video & photo repair & recovery service
Top
 Profile  
 
bunty
 Post subject: Re: Adding Customs file Signatures in R-studio
PostPosted: October 21st, 2023, 10:23 
Offline

Joined: March 9th, 2017, 6:16
Posts: 103
Location: trinidad
Arch Stanton wrote:
I'd go with TAPE \x54\x41\x50\x45

If you don't have the spec you don't know how static rest of the 'header' is and so the larger the signature the more chance you will not pick up files with slightly different 'headers'.

OTOH if you know for a fact that for example first 20 bytes of a header are static, you go with that as it will reduce false positives.


Hi Thank you Joep
This is my first case and I have this single file for analysis so could not compare common pattern .
Thanks a lot for pointing out that larger signature has less chances a valuable lesson.I have not added footers because there are none (all zeros)
Thank you :good: :good: :-D


Attachments:
66.PNG
66.PNG [ 40.53 KiB | Viewed 4063 times ]
Top
 Profile  
 
fzabkar
 Post subject: Re: Adding Customs file Signatures in R-studio
PostPosted: October 21st, 2023, 10:42 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15539
Location: Australia
It's Microsoft Tape Format (MTF). See pages 29 and 34 of the following document.

Microsoft ™ Tape Format Specification Version 1.00a:
http://laytongraphics.com/mtf/MTF_100a.PDF

_________________
A backup a day keeps DR away.
Top
 Profile  
 
fzabkar
 Post subject: Re: Adding Customs file Signatures in R-studio
PostPosted: October 21st, 2023, 11:13 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15539
Location: Australia
The Soft Filemark Descriptor Block (MTF_SFMB) is described on page 57. There is a list of Descriptor Blocks on page 30.

_________________
A backup a day keeps DR away.
Top
 Profile  
 
bunty
 Post subject: Re: Adding Customs file Signatures in R-studio
PostPosted: October 22nd, 2023, 10:21 
Offline

Joined: March 9th, 2017, 6:16
Posts: 103
Location: trinidad
fzabkar wrote:
It's Microsoft Tape Format (MTF). See pages 29 and 34 of the following document.

Microsoft ™ Tape Format Specification Version 1.00a:
http://laytongraphics.com/mtf/MTF_100a.PDF


WOW fzabkar :good: :-D
Thank you so much you have gone in depth. Though I didn't understood anything as its too low level it discusses this signature most profoundly.
Top
 Profile  
 
fzabkar
 Post subject: Re: Adding Customs file Signatures in R-studio
PostPosted: October 22nd, 2023, 12:00 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15539
Location: Australia
Find the TAPE header. The 16-bit word at offset 0x40 then tells you the size, in 512-byte sectors, of the SFMB descriptor block. In your case this is 1 sector.

Now locate the SFMB signature and count forwards by 0x200 bytes. That's the end of your file, IIUC.

_________________
A backup a day keeps DR away.
Top
 Profile  
 
athena
 Post subject: Re: Adding Customs file Signatures in R-studio
PostPosted: October 24th, 2023, 7:37 
Offline

Joined: May 30th, 2014, 0:54
Posts: 125
Location: Universe
fzabkar wrote:
Find the TAPE header. The 16-bit word at offset 0x40 then tells you the size, in 512-byte sectors, of the SFMB descriptor block. In your case this is 1 sector.

Now locate the SFMB signature and count forwards by 0x200 bytes. That's the end of your file, IIUC.

Thanks much useful fzabkar :good:
Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  Page 1 of 1
  [ 9 posts ] 

Main » Forums home » Research and development

All times are UTC - 5 hours [ DST ]

Who is online

Users browsing this forum: No registered users and 42 guests

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Switch to mobile style
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group